# CVEs published 2020-03-16

89 CVEs were published on March 16, 2020: 3 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-9347](https://cve.now/CVE-2020-9347.md): Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by t (no CVSS)
- [CVE-2020-9346](https://cve.now/CVE-2020-9346.md): Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated b (no CVSS)
- [CVE-2019-20191](https://cve.now/CVE-2019-20191.md): Oxygen XML Editor 21.1.1 allows XXE to read any file. (no CVSS)
- [CVE-2020-8784](https://cve.now/CVE-2020-8784.md): SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). (no CVSS)
- [CVE-2020-8785](https://cve.now/CVE-2020-8785.md): SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). (no CVSS)
- [CVE-2020-8786](https://cve.now/CVE-2020-8786.md): SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). (no CVSS)
- [CVE-2020-8787](https://cve.now/CVE-2020-8787.md): SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. (no CVSS)
- [CVE-2019-20326](https://cve.now/CVE-2019-20326.md): A heap-based buffer overflow in \_cairo\_image\_surface\_create\_from\_jpeg() in extensions/cairo\_io/cairo-image-surface-jpeg.c in GNOME gThumb be (no CVSS)
- [CVE-2020-8783](https://cve.now/CVE-2020-8783.md): SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4). (no CVSS)
- [CVE-2020-7982](https://cve.now/CVE-2020-7982.md): An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. (no CVSS)
- [CVE-2020-7919](https://cve.now/CVE-2020-7919.md): Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attack (no CVSS, github.com/helm/helm · helm.sh/helm/v3 +2)
- [CVE-2020-7248](https://cve.now/CVE-2020-7248.md): libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack b (no CVSS)
- [CVE-2020-6175](https://cve.now/CVE-2020-6175.md): Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. (no CVSS)
- [CVE-2019-19852](https://cve.now/CVE-2019-19852.md): An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel mo (no CVSS)
- [CVE-2019-19615](https://cve.now/CVE-2019-19615.md): Multiple XSS vulnerabilities exist in the Backup & Restore module \\ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php (no CVSS)
- [CVE-2019-19613](https://cve.now/CVE-2019-19613.md): An issue was discovered in Halvotec RaQuest 10.23.10801.0. (no CVSS)
- [CVE-2019-19612](https://cve.now/CVE-2019-19612.md): An issue was discovered in Halvotec RaQuest 10.23.10801.0. (no CVSS)
- [CVE-2019-19610](https://cve.now/CVE-2019-19610.md): An issue was discovered in Halvotec RaQuest 10.23.10801.0. (no CVSS)
- [CVE-2019-20491](https://cve.now/CVE-2019-20491.md): cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508). (no CVSS)
- [CVE-2019-19538](https://cve.now/CVE-2019-19538.md): In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerabi (no CVSS)
- [CVE-2019-19461](https://cve.now/CVE-2019-19461.md): Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a sh (no CVSS)
- [CVE-2019-18917](https://cve.now/CVE-2019-18917.md): A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout. (no CVSS, HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2…)
- [CVE-2020-7608](https://cve.now/CVE-2020-7608.md): yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "\_\_proto\_\_" payload. (no CVSS, yargs-parser)
- [CVE-2019-19212](https://cve.now/CVE-2019-19212.md): Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). (no CVSS, dolibarr/dolibarr)
- [CVE-2020-9472](https://cve.now/CVE-2020-9472.md): Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality. (no CVSS, UmbracoCms)
- [CVE-2019-19937](https://cve.now/CVE-2019-19937.md): In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, wh (no CVSS)
- [CVE-2020-9471](https://cve.now/CVE-2020-9471.md): Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality. (no CVSS, UmbracoCMS.Core)
- [CVE-2017-12842](https://cve.now/CVE-2017-12842.md): Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even i (no CVSS)
- [CVE-2019-11073](https://cve.now/CVE-2019-11073.md): A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insuff (no CVSS)
- [CVE-2020-9321](https://cve.now/CVE-2020-9321.md): configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before (no CVSS, github.com/containous/traefik · github.com/containous/tr… +1)
- [CVE-2019-19946](https://cve.now/CVE-2019-19946.md): The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team. (no CVSS)
- [CVE-2019-5543](https://cve.now/CVE-2019-5543.md): For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstati (no CVSS, VMware Horizon Client for Windows · VMware Remote Consol… +1)
- [CVE-2020-5849](https://cve.now/CVE-2020-5849.md): Unraid 6.8.0 allows authentication bypass. (CVSS 7.5, KEV)
- [CVE-2020-5847](https://cve.now/CVE-2020-5847.md): Unraid through 6.8.0 allows Remote Code Execution. (CVSS 9.8, KEV)
- [CVE-2020-5844](https://cve.now/CVE-2020-5844.md): index.php?sec=godmode/extensions&sec2=extensions/files\_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious P (no CVSS)
- [CVE-2020-3947](https://cve.now/CVE-2020-3947.md): VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. (no CVSS, VMware Workstation · VMware Fusion)
- [CVE-2020-3948](https://cve.now/CVE-2020-3948.md): Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vuln (no CVSS, VMware Workstation · VMware Fusion)
- [CVE-2019-19945](https://cve.now/CVE-2019-19945.md): uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. (no CVSS)
- [CVE-2019-19821](https://cve.now/CVE-2019-19821.md): A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information a (no CVSS)
- [CVE-2020-6582](https://cve.now/CVE-2020-6582.md): Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number (no CVSS)
- [CVE-2020-6581](https://cve.now/CVE-2020-6581.md): Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty\_metachars interprets \\n as the character \\ and the character n (not (no CVSS)
- [CVE-2020-7916](https://cve.now/CVE-2020-7916.md): be\_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself (no CVSS)
- [CVE-2020-10243](https://cve.now/CVE-2020-10243.md): An issue was discovered in Joomla! before 3.9.16. (no CVSS)
- [CVE-2020-10242](https://cve.now/CVE-2020-10242.md): An issue was discovered in Joomla! before 3.9.16. (no CVSS)
- [CVE-2020-10241](https://cve.now/CVE-2020-10241.md): An issue was discovered in Joomla! before 3.9.16. (no CVSS)
- [CVE-2019-19135](https://cve.now/CVE-2019-19135.md): In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.O (no CVSS, org.eclipse.milo:sdk-client)
- [CVE-2020-10240](https://cve.now/CVE-2020-10240.md): An issue was discovered in Joomla! before 3.9.16. (no CVSS)
- [CVE-2020-10239](https://cve.now/CVE-2020-10239.md): An issue was discovered in Joomla! before 3.9.16. (no CVSS)
- [CVE-2020-10238](https://cve.now/CVE-2020-10238.md): An issue was discovered in Joomla! before 3.9.16. (no CVSS)
- [CVE-2020-6984](https://cve.now/CVE-2020-6984.md): Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions (CVSS 9.8, Rockwell Automation MicroLogix 1400 Controllers Series B v2…)
- [CVE-2020-6990](https://cve.now/CVE-2020-6990.md): Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions (CVSS 9.8, Rockwell Automation MicroLogix 1400 Controllers Series B v2…)
- [CVE-2020-6988](https://cve.now/CVE-2020-6988.md): Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions (CVSS 7.5, Rockwell Automation MicroLogix 1400 Controllers Series B v2…)
- [CVE-2020-6980](https://cve.now/CVE-2020-6980.md): Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions (no CVSS, Rockwell Automation MicroLogix 1400 Controllers Series B v2…)
- [CVE-2020-10230](https://cve.now/CVE-2020-10230.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp\_{SESSION\_HASH}/admin/loader\_ajax.php t (no CVSS)
- [CVE-2020-6584](https://cve.now/CVE-2020-6584.md): Nagios Log Server 2.1.3 has Incorrect Access Control. (no CVSS)
- [CVE-2020-6585](https://cve.now/CVE-2020-6585.md): Nagios Log Server 2.1.3 has CSRF. (no CVSS)
- [CVE-2020-6586](https://cve.now/CVE-2020-6586.md): Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. (no CVSS)
- [CVE-2019-4719](https://cve.now/CVE-2019-4719.md): IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by incl (CVSS 5.1, IBM MQ)
- [CVE-2019-4656](https://cve.now/CVE-2019-4656.md): IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an auth (CVSS 6.5, IBM MQ)
- [CVE-2019-4619](https://cve.now/CVE-2019-4619.md): IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by incl (CVSS 5.1, IBM MQ)
- [CVE-2019-4617](https://cve.now/CVE-2019-4617.md): IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixatio (CVSS 5.9, IBM Cloud Automation Manager)
- [CVE-2019-19942](https://cve.now/CVE-2019-19942.md): Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Busin (no CVSS)
- [CVE-2019-19941](https://cve.now/CVE-2019-19941.md): Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain ent (no CVSS)
- [CVE-2019-19940](https://cve.now/CVE-2019-19940.md): Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticat (no CVSS)
- [CVE-2020-1738](https://cve.now/CVE-2020-1738.md): A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. (CVSS 3.9, Red Hat ansible · ansible)
- [CVE-2019-19851](https://cve.now/CVE-2019-19851.md): An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at th (no CVSS)
- [CVE-2020-1740](https://cve.now/CVE-2020-1740.md): A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. (CVSS 3.9, Red Hat ansible · ansible)
- [CVE-2020-1735](https://cve.now/CVE-2020-1735.md): A flaw was found in the Ansible Engine when the fetch module is used. (CVSS 4.2, Red Hat ansible · ansible)
- [CVE-2020-1736](https://cve.now/CVE-2020-1736.md): A flaw was found in Ansible Engine when a file is moved using atomic\_move primitive as the file mode cannot be specified. (CVSS 2.2, Red Hat ansible · ansible)
- [CVE-2019-19211](https://cve.now/CVE-2019-19211.md): Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. (no CVSS, dolibarr/dolibarr)
- [CVE-2019-19210](https://cve.now/CVE-2019-19210.md): Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files. (no CVSS, dolibarr/dolibarr)
- [CVE-2019-14887](https://cve.now/CVE-2019-14887.md): A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't ho (CVSS 7.4, Red Hat wildfly)
- [CVE-2019-19209](https://cve.now/CVE-2019-19209.md): Dolibarr ERP/CRM before 10.0.3 allows SQL Injection. (no CVSS, dolibarr/dolibarr)
- [CVE-2019-19208](https://cve.now/CVE-2019-19208.md): Codiad Web IDE through 2.8.4 allows PHP Code injection. (no CVSS, codiad/codiad)
- [CVE-2019-14512](https://cve.now/CVE-2019-14512.md): LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admi (no CVSS)
- [CVE-2018-10125](https://cve.now/CVE-2018-10125.md): Contao before 4.5.7 has XSS in the system log. (no CVSS, contao/contao · contao/core-bundle +1)
- [CVE-2020-1753](https://cve.now/CVE-2020-1753.md): A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all (CVSS 5.0, Red Hat Ansible · ansible)
- [CVE-2018-13063](https://cve.now/CVE-2018-13063.md): Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. (no CVSS)
- [CVE-2018-13060](https://cve.now/CVE-2018-13060.md): Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. (no CVSS)
- [CVE-2020-10557](https://cve.now/CVE-2020-10557.md): An issue was discovered in AContent through 1.4. (no CVSS)
- [CVE-2019-10091](https://cve.now/CVE-2019-10091.md): When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries (no CVSS, Apache Geode · org.apache.geode:geode-core)
- [CVE-2020-9518](https://cve.now/CVE-2020-9518.md): Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions 9.50, 9.51, 9.52, 9. (no CVSS, Micro Focus International Service Manager (Web Tier).)
- [CVE-2020-9519](https://cve.now/CVE-2020-9519.md): HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, (no CVSS, Micro Focus International Service Manager (Server).)
- [CVE-2020-5547](https://cve.now/CVE-2020-5547.md): Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmwa (no CVSS, Mitsubishi Electric MELQIC IU1 series)
- [CVE-2020-5545](https://cve.now/CVE-2020-5545.md): TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote a (no CVSS, Mitsubishi Electric MELQIC IU1 series)
- [CVE-2020-5546](https://cve.now/CVE-2020-5546.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of (no CVSS, Mitsubishi Electric MELQIC IU1 series)
- [CVE-2020-5543](https://cve.now/CVE-2020-5543.md): TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not proper (no CVSS, Mitsubishi Electric MELQIC IU1 series)
- [CVE-2020-5544](https://cve.now/CVE-2020-5544.md): Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware (no CVSS, Mitsubishi Electric MELQIC IU1 series)
- [CVE-2020-5542](https://cve.now/CVE-2020-5542.md): Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0 (no CVSS, Mitsubishi Electric MELQIC IU1 series)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.